Azure DevOps Privilege Escalation: Pipeline Shenanigans
Demonstrates azure DevOps Privilege Escalation: Pipeline Shenanigans and evaluates key implications for security practitioners.
Summary
Speaker and Scope
A security tester turned DevSecOps practitioner presents offensive Azure DevOps pipeline abuse. She contrasts a well-meaning project administrator with a compromised or malicious developer account.
Pipeline Building Blocks
Azure DevOps ties repositories to YAML-defined pipelines executed by agents. Agents often hold privileges developers lack, creating a first escalation path inside the project.
Service Connections as Secrets
Pipelines also use service connections storing credentials such as Azure service principals or third-party API keys. Those stored secrets form a second privilege-escalation avenue into cloud and tooling accounts.
Live Demo Setup
The demo project includes a pipeline with variable groups, hidden secrets referenced in build steps, and an Azure service connection for deployment. The speaker walks through where YAML, library variables, and service connections live before showing how a rogue developer might hijack them.
Related talks
Briefings·37 min
Naor Haziz
Amazon Elastic Container Service (ECS) is a popular container orchestration service that relies on IAM roles for fine-grained access control.
fwd:cloudsec·21 min
Seth Art
Seth Art explores Discovering New AWS Privilege Escalation Paths with an AI-Driven Workflow.
fwd:cloudsec·21 min
Erik Steringer
Erik Steringer investigates Automating AWS Privilege Escalation Risk Detection With Principal Mapper.